Research Update Enhanced src/network-services-pentesting/141...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL:
• Blog Title: Research Update Enhanced src/network-services-pentesting/1414-pentesting-ibmmq.md
• Suggested Section: Research

🎯 Content Summary

Research Update for src/network-services-pentesting/1414-pentesting-ibmmq.md

This PR contains automated research updates including:

• Latest security vulnerabilities and attack vectors
• Updated techniques and tools
• Enhanced explanations and examples
• Additional references and resources

Generated by: HackTricks Research Agent
Timestamp: 2026-04-15 03:24:29 UTC

Tool usage

• apply_patch: 1
• brave_search: 6
• exec: 19
• search_google_web: 11
• task_steps_manager: 6

This ...

🔧 Technical Details

Research update for HackTricks content

🤖 Agent Actions

I’m reading the current IBM MQ page first, then I’ll compare nearby HackTricks content so the update adds only material that is both current and non-duplicative.
The current page already covers MQ client access, 9443 admin REST usage, and service-based RCE. I’m pulling the rest of the file plus adjacent message-broker pages to identify gaps worth filling rather than repeating generic queue-broker content.
I have the local context now. Next I’m validating recent IBM MQ-specific material from primary and practitioner sources so the update is anchored in current behavior, not generic broker advice.
The likely gaps are around mqweb beyond plain MQSC, plus the exact authority model behind remote PCF. I’m checking whether IBM’s newer REST surfaces can be abused for message access and whether that deserves a focused addition.
I’ve got enough verified material to write a focused update. The changes will stay narrow: extend the 9443 attack surface from “admin MQSC” to “message access + token reuse”, and add privilege-recon commands that explain why some PCF actions fail.
I’m editing the IBM MQ page now. The patch adds only three high-signal pieces: mqweb message abuse on 9443, authority-recon commands for 2035 triage, and token-based REST session reuse.
Updated 1414-pentesting-ibmmq.md.

The main additions are focused and IBM MQ-specific:

• Expanded the 9443 coverage to include the messaging REST API, not just admin MQSC over mqweb. The page now shows how to browse, destructively get, and inject messages through /ibmmq/rest/v3/messaging/... when 1414 is filtered.
• Added an Effective authorities section explaining why many remote PCF actions fail with 2035, with practical DISPLAY AUTHREC, REST MQSC, and dspmqaut examples against SYSTEM.ADMIN.COMMAND.QUEUE and SYSTEM.DEFAULT.MODEL.QUEUE.
• Added a concise token-based auth reuse example showing how mqweb issues an LtpaToken2 cookie and how that session can be replayed for later admin actions on 9443.

I verified the final diff and kept the structure intact. The ## References section is still the last section, and I added only two new highly relevant references.

Sources used during research:

• https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=resources-adminactionqmgrqmgrnamemqsc
• https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=api-getting-started-administrative-rest
• https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=mq-messaging-using-rest-api
• https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=api-getting-started-messaging-rest
• https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=security-using-token-based-authentication-rest-api
• https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=records-interaction-chlauth-connauth
• https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=aao-controlling-access-objects-by-using-oam-aix-linux-windows
• https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=reference-mq-control-commands
• https://raw.githubusercontent.com/ibm-messaging/mq-container/master/docs/developer-config.md
• https://raw.githubusercontent.com/sensepost/punch-q/master/README.md
• https://sensepost.com/blog/2018/punching-messages-in-the-q/
• https://gist.github.com/mgeeky/2efcd86c62f0fb3f463638911a3e89ec

Verification was limited to content review and git diff; I did not run a markdown linter or build the book locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post:

Content Categories: Based on the analysis, this content was categorized under "Research".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0